CVE-2021-32862

2022-08-1819:15:14

Debian Security Bug Tracker

security-tracker.debian.org

github

cross-site scripting

nbconvert

html

web server

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

25.0%

JSON

The GitHub Security Lab discovered sixteen ways to exploit a cross-site scripting vulnerability in nbconvert. When using nbconvert to generate an HTML version of a user-controllable notebook, it is possible to inject arbitrary HTML which may lead to cross-site scripting (XSS) vulnerabilities if these HTML notebooks are served by a web server (eg: nbviewer).

OSVersionArchitecturePackageVersionFilename
Debian12allnbconvert< 6.5.1-1nbconvert_6.5.1-1_all.deb
Debian11allnbconvert< 5.6.1-3+deb11u1nbconvert_5.6.1-3+deb11u1_all.deb
Debian999allnbconvert< 6.5.1-1nbconvert_6.5.1-1_all.deb
Debian13allnbconvert< 6.5.1-1nbconvert_6.5.1-1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	nbconvert	< 6.5.1-1	nbconvert_6.5.1-1_all.deb
Debian	11	all	nbconvert	< 5.6.1-3+deb11u1	nbconvert_5.6.1-3+deb11u1_all.deb
Debian	999	all	nbconvert	< 6.5.1-1	nbconvert_6.5.1-1_all.deb
Debian	13	all	nbconvert	< 6.5.1-1	nbconvert_6.5.1-1_all.deb